diff options
| author | Leo Liou <leoliou@google.com> | 2023-03-17 16:24:34 +0800 |
|---|---|---|
| committer | Leo Liou <leoliou@google.com> | 2023-03-31 13:25:05 +0800 |
| commit | ca6ca14a456ba4318da39cbcc69f6533f591d425 (patch) | |
| tree | cd7eb56678fad3abb399ebc61f1d4e8b667cbc7e | |
| parent | fe21211958a828ba79595fce7d78395902a2740b (diff) | |
| download | bluejay-sepolicy-ca6ca14a456ba4318da39cbcc69f6533f591d425.tar.gz | |
bluejay: add sepolicy for ufs_firmware_update process
Allow the script to access the specified partition and sysfs.
Bug: 273305212
Test: full build and test ffu flow
Change-Id: I6f86606ebf0da631d1d2c1a433a9d200d6cac51c
Signed-off-by: Leo Liou <leoliou@google.com>
| -rw-r--r-- | bluejay/genfs_contexts | 5 | ||||
| -rw-r--r-- | vendor/device.te | 2 | ||||
| -rw-r--r-- | vendor/file_contexts | 5 | ||||
| -rw-r--r-- | vendor/ufs_firmware_update.te | 10 |
4 files changed, 22 insertions, 0 deletions
diff --git a/bluejay/genfs_contexts b/bluejay/genfs_contexts index 0e9b2a8..6b11056 100644 --- a/bluejay/genfs_contexts +++ b/bluejay/genfs_contexts @@ -4,3 +4,8 @@ genfscon sysfs /devices/platform/10970000.hsi2c/i2c-5/i2c-cs40l26a u:object genfscon sysfs /devices/platform/10970000.hsi2c/i2c-6/i2c-cs40l26a u:object_r:sysfs_vibrator:s0 genfscon sysfs /devices/platform/10970000.hsi2c/i2c-7/i2c-cs40l26a u:object_r:sysfs_vibrator:s0 genfscon sysfs /devices/platform/10970000.hsi2c/i2c-8/i2c-cs40l26a u:object_r:sysfs_vibrator:s0 + +# Storage +genfscon sysfs /devices/platform/14700000.ufs/vendor u:object_r:sysfs_scsi_devices_0000:s0 +genfscon sysfs /devices/platform/14700000.ufs/model u:object_r:sysfs_scsi_devices_0000:s0 +genfscon sysfs /devices/platform/14700000.ufs/rev u:object_r:sysfs_scsi_devices_0000:s0 diff --git a/vendor/device.te b/vendor/device.te new file mode 100644 index 0000000..d2a91db --- /dev/null +++ b/vendor/device.te @@ -0,0 +1,2 @@ +# Block Devices +type fips_block_device, dev_type; diff --git a/vendor/file_contexts b/vendor/file_contexts new file mode 100644 index 0000000..a273c79 --- /dev/null +++ b/vendor/file_contexts @@ -0,0 +1,5 @@ +# Binaries +/vendor/bin/ufs_firmware_update\.sh u:object_r:ufs_firmware_update_exec:s0 + +# Devices +/dev/block/platform/14700000\.ufs/by-name/fips u:object_r:fips_block_device:s0 diff --git a/vendor/ufs_firmware_update.te b/vendor/ufs_firmware_update.te new file mode 100644 index 0000000..53ceba5 --- /dev/null +++ b/vendor/ufs_firmware_update.te @@ -0,0 +1,10 @@ +type ufs_firmware_update, domain; +type ufs_firmware_update_exec, vendor_file_type, exec_type, file_type; + +init_daemon_domain(ufs_firmware_update) + +allow ufs_firmware_update vendor_toolbox_exec:file execute_no_trans; +allow ufs_firmware_update block_device:dir r_dir_perms; +allow ufs_firmware_update fips_block_device:blk_file rw_file_perms; +allow ufs_firmware_update sysfs:dir r_dir_perms; +allow ufs_firmware_update sysfs_scsi_devices_0000:file r_file_perms; |